Re: [T2TRG] [core] Disclosing Implementation Information: draft-bormann-t2trg-rel-impl-01.txt

[Christian Amsüss <[e-mail]>]

On Fri, Mar 27, 2020 at 05:13:19PM +0100, Carsten Bormann wrote:
> Comments (+1, -1, or actual text) would be welcome, both from T2TRG
> and from CoRE.  It seems the CoRE working group might want to consider
> working group adoption of this draft or a next version, at which time
> it would transition from the RG context to the WG.

+1 on making implementation information something that is common, and on
rel-impl as a starting point.

We're seeing millions of CoAP devices on the Internet now, and I'm
rather confident some of them do not implement all the amplification
mitigation RFC7252 says they should do. With implementation information,
reactions to large-scale attacks amplified through them can be made into
a productive "everyone still using version X of Y *please* update to X2,
which has been released two years ago already" rather than a blunt
"Don't use CoAP".

Servers written using aiocoap have been showing a link to the library
version by default[1] since version 0.4b1, and I've heard some positive
feedback from the RIOT community towards making this default as well.

> Would it make sense to standardize how to exactly express the
> information about the implementation and version? Being able to find
> that information seems useful -- but incomplete :-)

Structured information can be there in the payload using media types, as
Carsten pointed out.

I know some neat metadata format that can either embed such
representations, or just include them if they use the same metadata
format[2], but practically expect that the operators or tools that look
those up will manage to follow the link.

KR
c

[1]: https://aiocoap.readthedocs.io/en/latest/module/aiocoap.resource.html?highlight=wkc#aiocoap.resource.WKCResource
[2]: 
```
core: impl-info <https://example.com/product1/0.99b1> {
    base:representation h'a2....' { http:type "application/metadata+cbor" }
    # alternatively
    versioninfo:vendor "Example Ltd"
    versioninfo:product "ProductOne"
    versioninfo:semver "0.99b1"
}
```

-- 
To use raw power is to make yourself infinitely vulnerable to greater powers.
  -- Bene Gesserit axiom